Certificate-based pairing of key fob device and control unit

ABSTRACT

A key fob device, in one embodiment, includes a transceiver that receives and sends signals, a memory that stores a public key and a certificate of authenticity associated with the key fob device, and a processor coupled to the transceiver and memory. The processor is configured to execute instructions causing the key fob device to transmit the public key and the certificate of authenticity, execute a public key agreement protocol to generate a common secret encryption key, and receive an operation key encrypted with the common secret encryption key.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a divisional of and claims priority to U.S.patent application Ser. No. 13/942,367, filed Jul. 15, 2013, whichclaims priority to U.S. Provisional Patent Application No. 61/672,463,filed on Jul. 17, 2012 and U.S. Provisional Patent Application No.61/672,474, filed on Jul. 17, 2012, all of which are hereby incorporatedby reference in their entireties.

BACKGROUND

Wireless key fobs and their respective vehicles may use encryptedoperational keys to authenticate communications that occur between thetwo. For the key fob and the vehicle to be able to communicate, theymust be paired at some point in either the manufacturing or the salesprocess. The pairing of wireless key fobs and their respective vehiclesconventionally requires the vehicle manufacturer to deliver to thevarious vehicle dealers a secret key associated with each key fob wherethe secret key is a cryptographic key. A key fob's secret key may bethen be used to associate the key fob with a vehicle, or pair the keyfob and the vehicle. Multiple key fobs are typically paired with eachvehicle. This step of delivering to the vehicle dealers the secret keymay and the fact that each of these key fobs must store the secret key,however, open a means for theft of the secret key leading tounauthorized key fobs and potential theft.

SUMMARY

The problems noted above are solved in large part by a key fob-controlunit pairing device that includes a transceiver to transmit and receivesignals, a memory to store a certificate of authenticity (CertVD)associated with the pairing device and a public key (PKVM), and aprocessor coupled to said transceiver and memory. The processor is toreceive a public key (PKKF) from a key fob and associated with the keyfob and a certificate of authenticity (CertKF) associated with the keyfob, verify the CertKF with the PKVM, and transmit an encrypted PKKF toa control unit.

The solution may also involve a key fob that includes a transceiver toreceive and send signals, a memory to store a public key (PKKF) and acertificate of authenticity (CertKF) associated with the key fob, and aprocessor coupled to said transceiver and memory. The processor is totransmit the PKKF and the CertKF to a pairing device, execute a publickey agreement protocol to generate a common secret encryption key, andreceive, from a control unit, an operation key encrypted with the commonsecret encryption key.

Another solution to the above problem may be a method to pair a key foband a control unit of a vehicle that includes reading, by a pairingdevice, a public encryption key (PKKF) and a certificate of authenticity(CertKF) from a key fob, verifying, by the pairing device, the CertKFusing a public encryption key of a vehicle manufacturer (PKVM),transmitting, by the pairing device, a certificate of authenticity(CertVD) to a control unit, verifying, by the control unit, the CertVDusing the PKVM, executing, by the pairing device and the control unit, apublic key agreement to generate an encryption key DHKey1, encrypting,by the pairing device, the PKKF using the DHKey1, transmitting, by thepairing device, the encrypted PKKF to the control unit, executing, bythe control unit and the key fob, a public key agreement to generate anencryption key DHKey2, encrypting, by the control unit, an operationalkey using the DHKey2, and transmitting, by the control unit, theencrypted operational key to the key fob.

BRIEF DESCRIPTION OF THE DRAWINGS

For a detailed description of exemplary embodiments of the invention,reference will now be made to the accompanying drawings in which:

FIG. 1 shows an example vehicle manufacturing flow from sub-unitmanufacturing to the vehicle dealership implementing a certificate-basedauthentication key fob-control unit pairing in accordance with variousexamples as discussed herein;

FIG. 2 is an example key fob and control unit pre-pairing conditioningprocess for certificate-based authentication in accordance with variousexamples as described herein;

FIG. 3 shows an example of an initial pairing process of a control unitand a key fob using certificate-based authentication in accordance withvarious embodiments as discussed herein;

FIGS. 4 is a block diagram of an example pairing device in accordancewith various examples discussed herein;

FIGS. 5 is a block diagram of an example key fob in accordance withvarious examples discussed herein;

FIGS. 6 is a block diagram of an example control unit in accordance withvarious examples discussed herein;

FIG. 7 shows an example operation of a paired key fob and control unitafter pairing in accordance with various examples as discussed herein;

FIG. 8 shows an example of an operational key change by a CU inaccordance with various examples as discussed herein;

FIG. 9 is an example flow diagram of a method for the certificate-basedauthentication in accordance with various examples discussed herein; and

NOTATION AND NOMENCLATURE

Certain terms are used throughout the following description and claimsto refer to particular system components. As one skilled in the art willappreciate, companies may refer to a component by different names. Thisdocument does not intend to distinguish between components that differin name but not function. In the following discussion and in the claims,the terms “including” and “comprising” are used in an open-endedfashion, and thus should be interpreted to mean “including, but notlimited to . . . ” Also, the term “couple” or “couples” is intended tomean either an indirect or direct wired or wireless connection. Thus, ifa first device couples to a second device, that connection may bethrough a direct wired or wireless connection, or through an indirectwired or wireless connection via other devices and connections.

DETAILED DESCRIPTION

The following discussion is directed to various embodiments of theinvention. Although one or more of these embodiments may be preferred,the embodiments disclosed should not be interpreted, or otherwise used,as limiting the scope of the disclosure, including the claims. Inaddition, one skilled in the art will understand that the followingdescription has broad application, and the discussion of any embodimentis meant only to be exemplary of that embodiment, and not intended tointimate that the scope of the disclosure, including the claims, islimited to that embodiment.

The pairing of key fobs and vehicles (e.g., automobiles, motorcycles,boats, scooters, etc.) may entail the transport and use of secureinformation to ensure imposter key fobs are not paired with vehicles,which may lead to theft. The full conventional process may be keptsecret by vehicle manufacturers to ensure the security of theirvehicles. This process, however, may require the manufacturer to developan expensive and dedicated IT system to generate secret keys and tomaintain their security. Yet, when vehicles are delivered todealerships, the secret keys are passed along so that multiple key fobsmay be paired at the final destination. The transportation of the secretkeys from manufacturer to dealer may present an opportunity for thesecret keys to be stolen leading to rogue and imposter key fobs.

In addition to vehicles, the disclosed methods may also be used to paira key fob with any type of control unit that allows for wirelessconnectivity and control. For instance, the disclosed techniques anddevices may be part of a garage door system, hotel entrance system, or aremote entry for a home. As such, the scope of this disclosure is notlimited to control units of vehicles. The use of vehicles and thepairing of key fobs with one or all the control units of a vehicle ismainly for descriptive purposes.

Disclosed herein are devices and methods for pairing key fobs withvehicles that may avoid the transport of the secret information to thedealerships and that may reduce the IT requirements of the vehiclemanufacturers. One method, a certificate-based authentication process,may involve the use of authenticated certificates and public/private keypairs associated with the various components and actors involved in thepairing process. In the certificate-based approach, a pairing device mayreceive the public key and the certificate from an associated key fob.The pairing device may also be authenticated by a vehicle control unitand establish a secret key between the pairing device and the controlunit. The pairing device may then encrypt the public key of the key fobwith the secret key and transmit the encrypted public key to the controlunit. The control unit may then know what key fob with which to pair.The control unit and the key fob may then generate another secret key touse between themselves, which may then be used by the control unit toencrypt an operational key. The encrypted operational key may then becommunicated to the key fob so to pair the two devices.

The certificate-based approach to pairing a key fob to a control unitmay involve all actors (manufacturers, assemblers, dealerships, etc.) toobtain a public and secret (private) encryption key, which may be usedto authenticate one another in the pairing process. That may mean thateach vehicle dealership (or dealer/pairing device), the vehiclemanufacturer, each key fob manufactured and assembled and each controlunit manufactured and installed in a vehicle to have their ownassociated public/secret key pairs. Once the components involved haveacquired their key pairs, the public keys may be certified by a trustedthird party or a certificate authority (CA). The CA may receive thepublic key and identification from the associated component to provetheir identity. After their identity is proven, the CA may then sign theparty's public key with the trusted third party's secret key. The signedpublic key becomes the certificate of authenticity for the requestingparty. To verify the identity of a certificate, another party needs tounlock the certificate using the trusted third party's public key. TheCA, for example, may be the vehicle manufacturer or a third partydesignated by the car manufacturer.

The various components—key fobs, pairing devices, and control units—mayuse certain public/secret keys and certificates to authenticate oneanother and to generate secret encryption keys to use for passinginformation between one another. The generation of the secret keys mayuse a public key agreement protocol, such as elliptical curveDiffie-Hellman (ECDH) or Elliptic Curve Cryptography (ECC). A pair ofcomponents, such as a key fob and a control unit, may use the secretencryption key as part of the pairing process.

FIG. 1 shows an example vehicle manufacturing flow 100 from sub-unitmanufacturing to the vehicle dealership implementing a certificate-basedauthentication key fob-control unit pairing in accordance with variousexamples as discussed herein. The flow 100 may include a key fobmanufacturer 102, a key fob assembly 104 (showing tier 1 of potentiallymultiple tiers), a control unit (CU) manufacturer 106, a CU assembly 108(showing tier 1 of potentially multiple tiers), a vehicle manufacturer110, and a vehicle dealer 112. The flow 100 shows the progression ofcomponents that may eventually be paired for operation and entrance intoa corresponding vehicle. Each vehicle may have multiple CUs with each CUcontrolling a different function, i.e., ignition, braking, entrance,trunk, etc. An individual key fob may be paired with one, a few, or allof the CUs of a corresponding vehicle. Additionally, each vehicle andvarious numbers of the CUs may be paired with multiple key fobs.Further, each key fob associated with a vehicle may be deactivated iflost or stolen without affecting any other key fobs associated with thatsame vehicle.

Each key fob may have a public key (PK_(KF)) and a secret key (SK_(KF))pair assigned to it and internally stored. The PK_(KF)/SK_(KF) pair maybe generated for and installed in each key fob by the key fobmanufacturer 102, the key fob assembly 104 or the vehicle manufacturer110. The vehicle manufacturer 110 may choose the most trusted entity forthe generation and installation of the PK_(KF)/SK_(KF) pairs to ensuresecrecy and security. The same goes for each control unit that ismanufactured and installed in a vehicle—each will have a key pair(PK_(CU)/SK_(CU)) generated and installed into an associated CU by atrusted party—the CU manufacturer 106, the CU assembly 108 or thevehicle manufacturer 110.

In addition to the key fobs and CUs including their respective PK/SKpairs, each unit may also include a certificate of authenticity (Cert)that authenticates the component's identity. Conventionally, a Cert is averified and signed public key where the Cert is signed by a CA. The CAmay sign a Cert with its secret key. For security reasons, the vehiclemanufacturer 110 may be the trusted third party so they can control theflow and validity of Certs in the manufacturing and key fob-auto pairingprocess. As such, the vehicle manufacturer 110 may sign all public keyswith its secret key (SK_(VM)) to generate a corresponding certificate.For example, a Cert_(KF) will be inserted into an associated key fob. ACert_(CU) may correspond to a CU.

The vehicle dealer 112 may also obtain a key pair (PK_(VD) and SK_(VD))in order to be verified in the key fob-CU pairing process. The vehicledealer 112's key pair (and an associated Cert_(VD) also signed by thevehicle manufacturer 110) may be associated with a dealer pairing deviceor simply a pairing device. For simplicity of discussion, the keyfob-auto pairing will be described as occurring at the vehicle dealer112, but the pairing may also occur at the vehicle manufacturer 110without straying from the bounds of the present disclosure.

Before any key fob-CU pairing may commence, some conditioning steps maytake place at the various manufacturing and/or assembly locations. Theconditioning may be performed to prime the separate components—key fobs,CUs, dealership (pairing device)—so that the pairing functions asintended. However, the conditioning and pairing steps may be doneserially. If, for example, as is described herein, the pairing isperformed at the vehicle dealer 112, then the conditioning may occur atthe vehicle manufacturer 110.

FIG. 2 is an example key fob and control unit pre-pairing conditioningprocess 200 for certificate-based authentication in accordance withvarious examples as described herein. The conditioning process 200 mayinvolve the vehicle manufacturer 110, the vehicle dealer 112, a CU 202and a key fob 204. The steps of the conditioning process 200 are shownin a certain order but changes to the order are within the scope of thepresent disclosure. The order shown is for illustrative purposes only.The goal of the conditioning process 200 may be to condition or primethe respective components to facilitate the initial pairing of a key foband a CU, which may occur at the vehicle manufacturer 110's location orat a vehicle dealership 112.

The conditioning process 200 may begin at step 1 a with the vehicledealer 112 generating their encryption key pair—PK_(VD) and SK_(VD)—asdiscussed above. The dealer 112 may then transmit its PK_(VD) in anauthentic way to the vehicle manufacturer 110. Transmitting in anauthentic way may ensure the vehicle dealer 112's identity to thevehicle manufacturer 110 and the authentic transmission may bephysically mailing the PK_(VD) or delivering the PK_(VD) by a courier orsome other form of verified transmission. Upon receipt of the PK_(VD),the vehicle manufacturer 110 may then certify the PK_(VD) by signing thePK_(VD) with the vehicle manufacturer 110's secret key, SK_(VM),generating a certificate of authenticity (Cert_(VD)) for the vehicledealer 112. The vehicle manufacturer 110 then sends the Cert_(VD) backto the dealer 112, which may be inserted into the dealer's associatedpairing device.

The conditioning process 200 may also include the vehicle manufacturer110 inserting its public key, PK_(VM), into each vehicle's CU(s) 202 andalso into each key fob 204. The PK_(VM) inserted into the key fob 204and the CU 202 may be used at a later time to verify theauthenticity/identity of another device since all certificates ofauthenticity should be signed by the vehicle manufacturer 110, which canbe verified using the PK_(VM).

Lastly, as part of the conditioning process 200, the dealer 112 may readeach key fob 204's PK_(KF), which is not secret. The dealer may receivenumerous key fobs 204 at a time and may decide to read all of theirassociated public keys at once to store in the pairing device.Alternatively, the dealer 112 may read the PK_(KF) of a single key fobas part of the initial pairing process, to be described below.

FIG. 3 shows an example of an initial pairing process 300 of a controlunit and a key fob using certificate-based authentication in accordancewith various embodiments as discussed herein. The initial pairingprocess 300 may be performed at a vehicle manufacturer's location or ata vehicle dealership as shown. The initial pairing process 300 mayinclude the vehicle manufacturer 110, a pairing device 302 associatedwith a vehicle dealer 112, the key fob 204 and the CU 202. The pairingdevice 302 may already contain the PK_(VM), both may be used to verifythe identities of the other components—the CU 202 and the key fob 204.The pairing device 302 may be in communication with the key fob 204 andthe control unit 202 via a wireless connection, such as with Bluetooth,ultra-high frequency (UHF), or low frequency (LF), or they may beconnected via a wire. Wireless and wired connections between thecomponents are in the scope of this disclosure. Additionally oralternatively, the pairing device 302 may communicate wirelessly withone component, the key fob 204 for instance, and communicate via a wirewith another component, the CU 202 for instance.

Further, the pairing device 302 may be a handheld device, a fixedterminal, or a secure computer in a secure location of either thevehicle dealer 112 or the vehicle manufacturer 110 depending on wherethe pairing process is to occur. In either embodiment, the pairingdevice 302 may have a secure communication channel with the vehiclemanufacturer 110. The secure communication channel may be a permanentconnection or may be periodically established, nightly for example, toupdate lists and receive secure communications.

The initial pairing process 300 may begin by the pairing device 302receiving from the key fob 204 the PK_(KF) and the Cert_(KF) associatedwith the key fob, step 1 a. The information may be sent to the pairingdevice 302 from the key fob 204 as a result of a request sent by thepairing device 302. Alternatively, the key fob 204 may be periodicallybroadcasting its PK_(KF) and Cert_(KF). The pairing device 302 may thenverify the identity of the key fob 204 by verifying the authenticity ofthe Cert_(KF), step 1 b. The Cert_(KF) may be verified by the pairingdevice using the stored PK_(VM). The verification of the Cert_(KF) maybe performed by hashing the Cert_(KF) with the PK_(VM).

If the pairing device 302 is unable to verify the Cert_(KF), the key fob204 associated with that Cert_(KF) may be deemed a rogue and furtherpairing steps halted. Additionally or alternatively, the pairing device302 may verify that the received Cert_(KF) is not on a certificaterevocation list (CRL) maintained by the vehicle manufacturer 110, step 1c. This verification step may ensure that a specific Cert_(KF) has notbeen used numerous times before, which may signal a fraudulent key fob.The CRL may be stored in the memory of the pairing device 302 andperiodically updated or the pairing device 302 may have constant accessto the CRL maintained on a server at the vehicle manufacturer 110.

The pairing device 302, before, after or simultaneously with verifyingthe key fob 204, may begin communications with the CU 202 so that the CU202 may verify the identity of the pairing device 302. The pairingdevice 302, step 2 a, sends its Cert_(VD) to the CU 202. The CU 202,using the PK_(VM), verifies the authenticity of the Cert_(VD).Additionally or alternatively, the CU 202 may verify that the Cert_(VD)is not on a CRL, also maintained by the vehicle manufacturer 110. The CU202 may use a wireless access point at the vehicle dealer 112 to accessthe internet and a server at the vehicle manufacturer 110 to determineif the Cert_(VD) is on the revoke list, for example.

If the Cert_(VD) is unverifiable or is on the CRL, then the CU 202 maydetermine the pairing device 302 and/or the dealer 112 is fraudulent. Ifdeemed fraudulent, the CU 202 may cease communicating with the pairingdevice 302 and may alert the vehicle manufacturer 110.

If the CU 202 is able to verify the pairing device 302, then, step 3 a,both the CU 202 and the pairing device 302 execute a key agreementprotocol to generate a common secret key, DHKey1, which may only beknown by the pairing device 302 and the CU 202. After generation of theDHKey1, the pairing device 302 may encrypt the PK_(KF) of the key fob202 and transmit the encrypted PK_(KF) to the CU 202. Since the CU 202knows the DHKey1 and can decrypt the message revealing the PK_(KF), theCU 202 knows what key fob 204 with which to communicate and pair.

The CU 202 may initiate communication with the key fob 202, direct viawirelessly or through the pairing device 302. Once a communication linkis established between the key fob 204 and the CU 202, the twocomponents 202, 204, step 4 a, may execute a key agreement protocol togenerate a common secret key, DHKey2, known only by the CU 202 and thekey fob 204. The CU 204, step 4 b, may then generate an operational key(OpKey), encrypt the OpKey using DHKey2, and transmit the encryptedOpKey to the key fob 204. The OpKey may be a randomly generated 128-bitnumber.

The key fob 204 may then decrypt the message to learn the OpKey. At thispoint, the key fob 204 and the CU 202 may be deemed paired and normaloperation may commence. The key fob 204 and the CU 202 may use the OpKeyto authenticate one another in normal operation based on any standardprivate or public key authentication techniques, e.g. ISO 9798-2.

Pairing key fobs and control units may also be performed usingidentification (ID)-based authentication approach. The ID-based approachmay use unique identification words associated with key fobs and CUsthat may be used to both authenticate one another and to generate secretkeys between the devices. The secret keys would then be used to encryptand decrypt information sent between the two components. The pairing ofthe key fob and the CU, again, may be facilitated by a pairing devicelocated at either the vehicle dealership or at the vehicle manufacturerand which may be similar to the pairing device 302.

FIGS. 4, 5, and 6 show block diagrams of an example pairing device 302,key fob 204 and CU 202, respectively, in accordance with variousexamples discussed herein. The three devices/components—pairing device,key fob, and CU—may all comprise a processor (402, 502, 602), a memory(404, 504, 604), and a transceiver (406, 506, 606). The processors ofthe three devices/components may be used to perform the authenticationcomputations and the common secret key generation computationsassociated with the certificate-based authentication pairing and theID-based authentication pairing. The processors may be a standard CPU, amicrocontroller, a low-power digital signal processor, etc. and may becapable of performing complex calculations in a short time.

The memories of the three devices may be used to store the public andprivate key pairs and the certificates of authenticity associated withtheir respective device for the certificate-based authenticationpairing. Alternatively or additionally, the memories of the threedevices may be used to store the IDs of their own or the other devices.For example, in the ID-based authentication pairing, the pairing device302 may store both the KFID and the CUID before initiating a paringsequence. The KFID and CUID for those two associated devices may bestored in the memory 404 of the pairing device 302. The memories may bea non-volatile storage device such as flash memory or an EEPROM.

The transceivers for the three devices may be wired (not shown),wireless or capable of both. The transceivers may be used by the devicesto communicate the IDs, public keys, and/or certificates of authenticityduring the condition steps and the initial pairing steps for eitherauthentication approach. The key fobs allowing for remote entry andcontrol of vehicles may use a wireless technology such as Bluetooth, LF,or UHF for those transmissions but may also be able to communicate withthe pairing device and/or the CUs via a wire during the initial pairingprocess.

Additionally, the pairing device 302 may include a wired connection tothe vehicle manufacturer 110 so that the pairing device 302 may securelyreceive the CUIDs of the CUs 202 delivered to the dealer 112 for theID-based authentication pairing. For the certificate-basedauthentication pairing the pairing device 302 may communicate with thevehicle manufacturer 110 when accessing a certification revoke list.Additionally, the CU 202 either via the pairing device 302 or some otherconnection may also access a CRL at the vehicle manufacturer 110 whenchecking the validity of the CertVD of the pairing device 302.

FIG. 7 shows an example normal operation of a paired key fob and CU inaccordance with various examples as discussed herein. The normaloperation depicted in FIG. 9 shows the interaction between a key fob 204and a CU 202 post initial pairing by the process 300(certificate-based). The key fob and CU, when communicating with oneanother upon a user's interaction with the key fob for example, mayfirst authenticate one another by executing an OpKey authenticatedchallenge-response protocol based on AES-128, for example. Operation ofthe CU by the key fob may only be allowed when the response is valid. Aninvalid response may signify a rogue key fob and the CU may not performcommands sent from an invalid key fob.

FIG. 8 shows an example of an OpKey change by a CU in accordance withvarious examples as discussed herein. The CU 202 may change the OpKeywhen a key fob 206 is misplaced or is stolen. By changing the OpKey, theCU may prevent the missing or stolen key fob 206 from accessing the CU202. The CU 202 may be initiated by an external signal that a new OpKeyis desired. The external signal may come from the owner of the remainingkey fob(s) 204 by performing a preset sequence with the key fob andvehicle or the external signal may come from the pairing device 302 ofthe dealer 112. Upon receiving the external signal, the CU 202 mayencrypt a new OpKey using the old OpKey and then transmit the encryptednew OpKey to the remaining key fob(s) 204. After receiving the newOpKey, the old OpKey may be erased by all the CU 202 and the remainingkey fobs 204. Normal operation between the devices may then continuewithout worry that the rogue key fob may interact with the CU.

FIG. 9 is an example flow diagram of a method 900 for thecertificate-based authentication in accordance with various examplesdiscussed herein. The method 900A may be one implementation of theinitial pairing process 300 described in regards to FIG. 3. The method900 begins at step 902 with the pairing device 302 reading a publicencryption key (PK_(KF)) and a certificate of authenticity (Cert_(KF))from the key fob 204. The method 900 continues at step 904 with thepairing device 302 verifying the Cert_(KF) using a public encryption key(PK_(VM)) of the vehicle manufacturer 110. Step 906 continues the method900 with the pairing device 302 transmitting the certificate ofauthenticity (Cert_(VD)) to the CU 202. The CU 202 at step 908 verifiesthe Cert_(VD) using the PK_(VM), which may be stored in the memory 804of the CU 202. At step 910, the pairing device 302 and the CU 202execute a public key agreement protocol to generate a common secretencryption key DHKey1, which may only be known by the pairing device andthe CU.

The method 900 then continues at step 912 with the pairing device 302encrypting the PK_(KF) using the DHKey1 before the method 900 performsstep 914 with the pairing device 302 transmitting the encrypted PK_(KF)to the control unit 202. At step 916, the CU 202 and the key fob 204execute a public key agreement protocol to generate a common secretencryption key DHKey2 to be shared between the CU 202 and the key fob204. The method 900 ends with steps 918 and 920 with the CU 202encrypting an operational key (OpKey) with DHKey2 and then transmittingthe encrypted OpKey to the key fob 204. After the OpKey has been sharedwith the key fob 204, the CU 202 and the key fob 204 may be consideredpaired.

The above discussion is meant to be illustrative of the principles andvarious embodiments of the present invention. Numerous variations andmodifications will become apparent to those skilled in the art once theabove disclosure is fully appreciated. It is intended that the followingclaims be interpreted to embrace all such variations and modifications.

What is claimed is:
 1. A key fob device, comprising: a transceiver thatreceives and sends signals; a memory that stores a public key and acertificate of authenticity associated with the key fob device; and aprocessor coupled to the transceiver and memory, wherein the processoris configured to execute instructions that cause the key fob device to:transmit the public key and the certificate of authenticity; execute apublic key agreement protocol to generate a common secret encryptionkey; and receive an operation key encrypted with the common secretencryption key.
 2. The key fob device of claim 1, wherein the public keyand the certificate of authenticity are transmitted from the key fobdevice, via the transceiver, to a pairing device.
 3. The key fob deviceof claim 1, wherein the key fob device receives, via the transceiver,the operation key encrypted with the common secret encryption key from acontrol unit.
 4. The key fob device of claim 3, wherein receiving theoperation key encrypted with the common secret encryption key from thecontrol unit pairs the key fob device with the control unit.
 5. The keyfob device of claim 3, wherein the public key agreement protocol isexecuted with the control unit.
 6. The key fob device of claim 1,wherein the public key agreement protocol is based on elliptical curveDiffie-Hellman (ECDH) encryption.
 7. The key fob device of claim 1,wherein the public key agreement protocol is based on elliptical curvecryptography (ECC).
 8. The key fob device of claim 1, wherein theprocessor is configured to execute instructions that decrypt theoperation key with the common secret encryption key.
 9. The key fobdevice of claim 1, wherein the certificate of authenticity is signed bya certificate authority.
 10. The key fob device of claim 9, wherein thecertificate authority is a vehicle manufacturer.
 11. A method forpairing a key fob and a control unit of a vehicle, comprising: reading,by a pairing device, a first public encryption key and a firstcertificate of authenticity of a key fob; verifying, by the pairingdevice, the first certificate of authenticity using a second publicencryption key of a vehicle manufacturer; transmitting, by the pairingdevice, a second certificate of authenticity to a control unit;verifying, by the control unit, the second certificate of authenticityusing the second public encryption key; executing, by the pairing deviceand the control unit, a public key agreement to generate a first commonsecret encryption key; encrypting, by the pairing device, the firstpublic encryption key using the first common secret encryption key;transmitting, by the pairing device, the encrypted first publicencryption key to the control unit; executing, by the control unit andthe key fob, a public key agreement to generate a second common secretencryption key; encrypting, by the control unit, an operational keyusing the second common secret encryption key; and transmitting, by thecontrol unit, the encrypted operational key to the key fob.
 12. Themethod of claim 11, comprising: generating the first public encryptionkey for the key fob and inserting the first public encryption key into astorage device of the key fob; generating the second public encryptionkey and a secret encryption key pair for the vehicle manufacturer andstoring the second public encryption key and a secret encryption keypair in a vehicle manufacturer storage device; and generating a thirdpublic encryption key for a vehicle dealer and storing the third publicencryption key in a vehicle dealer storage device.
 13. The method ofclaim 11, comprising: generating a first certificate of authenticity forthe first public encryption key a second certificate of authenticity forthe third public encryption key by signing the first public encryptionkey and the third public encryption key with the secret encryption key;inserting the second public encryption key into a control unit storagedevice, into the key fob storage device, and into a storage device ofthe pairing device; and inserting the first certificate of authenticityinto the key fob storage device and the second certificate ofauthenticity into the pairing device storage device.
 14. The method ofclaim 11, comprising verifying, by the pairing device, that the firstcertificate of authenticity is not on a certificate revocation list. 15.The method of claim 11, comprising verifying, by the control unit, thatthe second certificate of authenticity is not on a certificaterevocation list.